@trops/dash-core 0.1.547 → 0.1.549

package/dist/electron/index.js

@@ -50368,6 +50368,42 @@ function safeSend(win, channel, data) {
   }
 }
 
+/**
+ * Resolve the working directory the spawned CLI should run in.
+ *
+ * Pure / no I/O — extracted so it can be unit-tested. The actual
+ * mkdir + spawnOpts.cwd assignment happens at the spawn site.
+ *
+ * Why this exists: when the widget-builder modal launches the CLI in
+ * lockdown mode, the spawned process inherits the parent (Electron)
+ * process cwd. In a dev build that's the dash-electron project root,
+ * which contains a CLAUDE.md describing the 4-phase development
+ * workflow. The CLI auto-loads that file and the AI announces "Let me
+ * scan the existing project to understand what's already here." —
+ * exactly what the lockdown was meant to prevent.
+ *
+ * Resolution order:
+ *   1. Caller passed an explicit cwd → use that (caller wins).
+ *   2. disableTools: true and no cwd → scratch dir under os.tmpdir().
+ *   3. Otherwise → null (caller doesn't set spawnOpts.cwd; the child
+ *      inherits the parent's cwd, preserving AssistantPanel behavior
+ *      where project context may be wanted).
+ *
+ * @param {object}  opts
+ * @param {string=} opts.cwd
+ * @param {boolean=} opts.disableTools
+ * @returns {string|null}
+ */
+function resolveLockdownCwd({ cwd, disableTools = false } = {}) {
+  if (cwd) return cwd;
+  if (disableTools) {
+    const os = require$$2$1;
+    const path = require$$1$1;
+    return path.join(os.tmpdir(), "dash-widget-builder-cli");
+  }
+  return null;
+}
+
 /**
  * Build the argv array for spawning the Claude Code CLI.
  *
@@ -50414,6 +50450,20 @@ function buildClaudeCliArgs({
     // Write — every built-in tool the AI might otherwise invoke from
     // inside the modal where only text + code-block output is wanted.
     args.push("--tools", "");
+
+    // `--tools ""` alone leaks ambient context: in 2.1.138 we saw the
+    // AI mention `mcp__dash__*` tool names by name, and the Skill
+    // tool kept firing despite the empty allowlist. The leak comes
+    // from outside cwd — global ~/.claude/CLAUDE.md, project memory
+    // under ~/.claude/projects/<key>/memory/, and user-installed
+    // skills. `--bare` is documented as "skip hooks, LSP, plugin
+    // sync, attribution, auto-memory, background prefetches, keychain
+    // reads, and CLAUDE.md auto-discovery." Combined with
+    // `--strict-mcp-config` (which suppresses every MCP server we
+    // don't explicitly pass via --mcp-config), the spawned CLI gets
+    // exactly our --system-prompt and nothing else.
+    args.push("--bare");
+    args.push("--strict-mcp-config");
   }
 
   if (model) {
@@ -50619,12 +50669,13 @@ const cliController$2 = {
         // files directly without a shell — ENOENT otherwise.
         shell: IS_WINDOWS,
       };
-      if (cwd) {
+      const resolvedCwd = resolveLockdownCwd({ cwd, disableTools });
+      if (resolvedCwd) {
         const fs = require("fs");
-        if (!fs.existsSync(cwd)) {
-          fs.mkdirSync(cwd, { recursive: true });
+        if (!fs.existsSync(resolvedCwd)) {
+          fs.mkdirSync(resolvedCwd, { recursive: true });
         }
-        spawnOpts.cwd = cwd;
+        spawnOpts.cwd = resolvedCwd;
       }
       const spawnCmd = IS_WINDOWS ? windowsQuote(binaryPath) : binaryPath;
       const spawnArgs = IS_WINDOWS ? args.map(windowsQuote) : args;
@@ -50946,6 +50997,7 @@ const cliController$2 = {
 
 cliController$3.exports = cliController$2;
 cliController$3.exports.buildClaudeCliArgs = buildClaudeCliArgs;
+cliController$3.exports.resolveLockdownCwd = resolveLockdownCwd;
 
 var cliControllerExports = cliController$3.exports;